Android Kernel CVE-2026-59043

Requires the ability to execute local code on the device (e.g., an installed malicious or compromised app) - AV:L means no remote reach. The specific trigger is a race condition in arm_lpae_split_blk_unmap within the ARM LPAE IOMMU page-table code (io-pgtable-arm-common.c), so the attacker must drive concurrent page-table unmap/split operations and win a timing window to cause memory corruption. No elevated privileges (PR:N) and no user interaction (UI:N) are needed. The principal LIMITING factor is the high attack complexity (AC:H): the race window must be hit, which SSVC confirms is not automatable, making exploitation unreliable and device-dependent rather than deterministic.

Multiple signals converge on a moderate, not urgent, risk. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.4 High) describes a local-only (AV:L) race condition requiring high attack complexity (AC:H) - meaning the attacker must win a narrow timing window - but needing no privileges (PR:N) and no user interaction, with total impact (C:H/I:H/A:H) consistent with kernel memory corruption leading to local privilege escalation. These severity signals are reinforced by SSVC's Technical Impact of 'total,' but tempered everywhere else: SSVC reports Exploitation 'none' and Automatable 'no' (a race condition cannot be reliably automated at scale), EPSS is very low at 0.15% (4th percentile), and the CVE is NOT on CISA KEV. The vuln.today decision label is 'this_week,' indicating it should be scheduled into the current patch cycle rather than treated as an emergency. No conflicting signals are present: the local attack vector, high complexity, low EPSS, absence from KEV, and 'none' exploitation status all agree this is a legitimate high-severity local EoP primitive but not a mass-exploitation or remote threat. The realistic concern is a malicious or compromised local Android app chaining this for privilege escalation, not opportunistic internet-wide attacks.

A malicious app installed on an Android device (or code already running locally in a low-privileged context) repeatedly triggers concurrent IOMMU page-table unmap operations to race arm_lpae_split_blk_unmap in the kernel, corrupting page-table memory. Winning the race corrupts kernel memory in a controllable way and is leveraged to escalate to kernel/root-level privileges without any user interaction. No public exploit identified at time of analysis, and the high attack complexity (AC:H) and non-automatable nature mean exploitation is difficult and unreliable rather than turnkey.